Indirect Calling of Nested Functions on GCC Without Executable Stack
An alternative method for safely calling nested functions in older GCC versions.
1Nested Functions and GCC's Supported Methods
GCC 17 and Clang offer a method for calling nested functions that requires the use of an executable stack. However, this method is not available in older GCC versions. In such cases, one must either accept the use of the stack or find an alternative method. This article explores a way to safely call nested functions in older GCC versions.
2How the Trampoline Mechanism Works
A trampoline is a short code sequence created on the stack for calling nested functions. This code sequence contains information such as the static chain and code address. The trampoline uses this information to call the nested function. However, this method requires the stack to be executable, which can lead to security vulnerabilities.
3Calling Nested Functions Without a Trampoline
To call nested functions without using a trampoline, the code address and static chain information within the trampoline can be extracted. This information can be used with the __builtin_call_with_static_chain function to directly call the nested function. This method does not require the stack to be executable and reduces security concerns.
4Alternative Method in Older GCC Versions
In older GCC versions, the noplate library can be used to extract the code address and static chain information from the trampoline. This library extracts the information and safely calls the nested function. This method provides an alternative for calling nested functions in older GCC versions.
5The Idea of Interpreting the Trampoline
Another idea is to use the trampoline as a function descriptor. When the trampoline is created, the code address and static chain information are extracted and used with the __builtin_call_with_static_chain function. This method interprets the trampoline code to call the nested function instead of invoking the trampoline.
6Reducing Security Concerns
Calling nested functions without using a trampoline does not require the stack to be executable. This reduces security concerns and makes the program more secure. Additionally, the patchelf --clear-execstack command can be used to remove the executable stack feature.
7The Role of the Noplate Library
The noplate library extracts the code address and static chain information from the trampoline and safely calls the nested function. This library provides an alternative for calling nested functions in older GCC versions and reduces security concerns.
8Conclusion and Recommendations
Alternative methods for safely calling nested functions in older GCC versions can be found without using a trampoline. These methods reduce security concerns and make the program more secure. The noplate library provides a useful tool for implementing these methods.
Original article: Hacker News — GCC'de Yığın Kullanmadan İç İşlevlerin Dolaylı Çağrılması